Plugin auth backend module cloudflare access provider: Backstage: Insufficient audience validation in the Cloudflare Access auth provider (CVE-2026-106457)

CVE-2026-106457 affects the @backstage/plugin-auth-backend-module-cloudflare-access-provider in versions >=0.1.0 <0.5.0. The module verifies token signature and team issuer but fails to validate the token's audience claim to ensure it was issued for the Backstage application. This flaw can allow an attacker holding a valid token for a different Cloudflare Access application within the same Zero Trust team to authenticate to Backstage if the token is presented directly to the auth endpoint without audience enforcement upstream. Typical Cloudflare Access deployments enforce audience checks before forwarding requests, so exploitation requires specific deployment topologies such as direct origin access or alternate proxy routes. The severity is medium with a CVSS 3.1 score of 6.8 (Network attack vector, High complexity, Low privileges required, No user interaction, High confidentiality and integrity impact, No availability impact). The issue is fixed in version 0.5.0, included in Backstage v1.55.0, which introduces a breaking configuration change requiring the audience to be explicitly set.

An attacker with a valid Cloudflare Access token for another application in the same Zero Trust team may authenticate to Backstage without possessing a token specifically issued for it, potentially gaining unauthorized access depending on the permissions mapped to that identity. This can lead to unauthorized access to Backstage resources. However, exploitation requires specific deployment conditions where the auth endpoint is accessible without audience enforcement upstream. The confidentiality and integrity of Backstage data are at risk, but availability is not impacted.

Upgrade the @backstage/plugin-auth-backend-module-cloudflare-access-provider package to version 0.5.0 or later. Before upgrading, configure the 'auth.providers.cfaccess.audience' setting to the correct Audience (AUD) tag for the Backstage application in Cloudflare Zero Trust. If immediate patching is not possible, restrict access to the Backstage auth endpoint to only the intended Cloudflare Access application, use a custom authenticator that validates the application audience, or disable the provider until the patch can be applied. These mitigations reduce the risk of unauthorized authentication via tokens issued for other applications.